Are symptom tracker apps private? What happens to your health data
Symptoms, medications, moods, cycles: a symptom tracker ends up holding some of the most personal information you have. Many people assume it's protected like a medical record. Often it isn't. Here's what really happens to your health data in an app, and how to choose one you can trust.
Health apps aren't your doctor's office
In the US, HIPAA protects health information held by doctors, hospitals, insurers and the companies working for them. An app you download and use on your own is usually outside HIPAA. Its privacy policy, consumer protection law and, in some states, specific health privacy laws set the rules instead.
In the UK and the EU, health data gets stronger protection under GDPR: it's a special category of personal data, and apps generally need your explicit consent to process it. That helps, but it doesn't stop an app from storing your data on its servers or sharing it with partners you've agreed to, sometimes without realizing.
What the Flo case showed
Flo, a popular period-tracking app, settled with the US Federal Trade Commission in 2021 over allegations that it shared users' health data with third parties despite promising privacy. In August 2025, a US jury found that Meta had illegally obtained health information from Flo users through tracking code embedded in the app. The lesson isn't about one app: tracking and analytics tools built into apps can send data to companies you never chose to share it with.
Five things to check before you start tracking
- Where is your data stored? On your phone only, or on the company's servers? Local storage means there's nothing for the company to leak, sell or hand over.
- Do you need an account? An account usually means your entries are synced to the company. If an app needs one, find out why.
- Who else gets data? Look at the "App Privacy" section of the App Store listing: "Data Used to Track You" and "Data Linked to You" tell you a lot. These labels are self-reported by developers, so read them alongside the privacy policy.
- What does the policy say about selling, sharing and AI? Watch for "partners", "advertising", "de-identified data" and "improving our services".
- Can you export and delete everything? You should be able to take your history with you and remove it completely.
Signs of a privacy-first health app
- Works without an account.
- Stores entries encrypted on your device.
- No advertising or tracking code.
- Shares a report only when you choose to export it.
- A business model you understand, such as a one-time price or a subscription, rather than "free" with ads.
If you already use a tracker
Check its privacy settings and App Store privacy labels today. If you're not comfortable with what you find, export your history (most apps offer a PDF or CSV), delete your account, and ask the company to confirm your data has been erased. Under GDPR, you have the right to ask.